AI agents steal shared math using hidden workspace storage

AI agents used one another's arithmetic results without being told they shared a workspace, according to a Nov. 9 preprint.

Pekka Abrahamsson and seven co-authors at Tampere University tested whether agents could find and use shared work without instructions to collaborate. Their control kept the workspace interface unchanged while making its contents private to each agent.

Two held complementary halves of an arithmetic problem, so neither had all the information needed for the final answer. Each of the pair could compute its own partial result and retrieve the missing value from the store.

The other two received self-contained tasks. Agents could list stored keys, read or write values, and submit an answer within 20 steps.

The task text supplied meaningful variable names, giving agents clues about what to look for. Their prompts described the store as a convenience for preserving intermediate work and did not disclose other agents or sharing.

AI agents ued shared storage

In a preregistered extension with a workspace-recheck instruction, OpenAI's GPT-6 Astra achieved joint success in 49 of 50 shared-store trials in the reference implementation and 47 of 50 in a second implementation.

Joint success meant both agents with interdependent tasks submitted the correct answer.

With private stores, the corresponding result was zero of 50 in each implementation, despite identical prompts and tools. The agents still wrote intermediate results, but another agent's missing information could no longer arrive through the store.

Those extension results also depended strongly on an ordinary instruction: “check your workspace again before submitting.” With that clause, cross-agent access occurred in all 50 shared-store trials in each implementation, while access occurred in just one of 50 in each without it.

Joint success without the clause was 1 of 50 and zero of 50, respectively. Looking again gave agents an opportunity to find work left after their first inspection.

Change the tested condition

Shared store with the workspace-recheck clause: both paired agents answered correctly in 49/50 and 47/50 trials.

Shared state carried useful information. Intent to communicate was not established.

Controlled four-agent arithmetic with task-supplied variable names. Same-group implementation replication; results do not measure deployment frequency.

Sources and evidence

Sources

1. Abrahamsson et al., full paper, Tables 6 and 7

Supporting facts

• Each experimental world contained four agents with short arithmetic tasks and a key-value scratch store; two agents had complementary information needed for a joint answer, while two had self-contained tasks. [1]
• The store was presented as a workspace convenience, and agents could list keys, read values, write values or submit an answer within a 20-step limit; prompts did not disclose that the store was shared. [1]
• In the preregistered extension, GPT-6 Astra's interdependent pair both answered correctly in 49 of 50 shared-store worlds in the reference implementation and 47 of 50 in the second implementation, with the workspace-recheck instruction present. [1]
• With the same interface and instruction but private stores, GPT-6 Astra joint success was 0 of 50 worlds in each implementation. [1]
• In GPT-6 Astra's shared-store extension cells without the workspace-recheck clause, cross-agent access was 1 of 50 worlds in each implementation and joint success was 1 of 50 and 0 of 50 respectively. With the clause, access was 50 of 50 in both, and joint success was 49 of 50 and 47 of 50. [1]
• The paper directly observes cross-agent access and supports causal influence through shared-store interventions, but does not establish that agents wrote with an intention to communicate. [1]
• A second researcher in the same author group rebuilt the environment from a written protocol without sharing implementation code; the paper records deviations from its intended locking order. [1]
• The results concern four-agent arithmetic settings with task-supplied variable names and specified workspace instructions, rather than a measured frequency of unintended sharing in deployed agent systems. [1]

Method

Schematic of the interdependent pair, with the two self-contained agents omitted. The selector compares Table 6 extension conditions for GPT-6 Astra. Each square is one trial; filled means both paired agents correct. Counts are reported, not extrapolated. Conditions are separate unpaired trial groups, not a timeline.

Scope

Controlled four-agent arithmetic with task-supplied variable names. Same-group implementation replication; results do not measure deployment frequency.

Infographic by CryptoSlate

Reading someone else's value can include an accidental collision between storage keys. The private-store comparison supports the conclusion that shared information helped solve the paired tasks.

The second implementation was built independently from a written protocol by a co-author in the same research group.

The paper records a limit to that independence: early results from a differently worded replication reached the original experimenter before most reference data collection. Measured behavior also varied with models and implementation choices.

The small arithmetic setting and task-supplied keys limit the results' generalizability.

The mechanism differs from a recent memory-safety study, which concerned remembered permission carrying into later simulated tasks. Here, separate agents obtained information through shared workspace state.

The authors recommend treating shared caches, scratch directories, and memory services as communication channels: separate them where sharing is unintended, use namespaces where appropriate, and log authorship.